Privacy Policy for markup

Effective Date: August 1, 2025
Last Updated: June 5, 2026

1. Introduction

Progressive Works, Inc. (“we,” “our,” or “us”) operates the markup application and the website at markup.progressiveworks.co (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the application or visit the website.

Progressive Works, Inc. is the data controller for personal data processed under this Privacy Policy.

2. Local-First Markdown Processing

markup is designed so your document content stays on your device.

  • Markdown documents are processed locally within the application.
  • Markdown content is used only for preview rendering and PDF export.
  • We do not transmit Markdown content, file names, LaTeX source, Mermaid definitions, PlantUML definitions, or generated PDF content to external rendering servers or analytics services.
  • PDF generation occurs on your device.
  • Supported LaTeX equations, Mermaid diagrams, and supported PlantUML diagrams are rendered locally.
  • The application does not rely on an external PlantUML rendering server, and PlantUML network includes are not part of the app rendering path.
  • Application settings, local font installation state, and preferences are stored locally on your device unless this policy describes a specific external service.

3. Information We Collect

3.1 Account Information

markup does not require a markup account. We do not operate user accounts for the application.

3.2 Subscription and Purchase Data

To unlock and restore premium features without markup accounts, the application uses app store purchase systems and Adapty. Depending on the platform and purchase flow, these systems may process:

  • purchase status, entitlement state, product identifiers, transaction information, and subscription renewal state;
  • SDK identifiers needed by Adapty to manage subscription status;
  • information needed for purchase verification, fraud prevention, customer support, and purchase restoration.

The application disables Adapty IP address collection where supported by the SDK configuration.

3.3 Optional Application Rendering Analytics

Application rendering analytics is off by default. If you explicitly enable usage analytics in the app, the application may send first-party anonymous rendering statistics to stats-markup.progressiveworks.co.

Rendering analytics may include:

  • Markdown block types and counts;
  • heading levels;
  • code language categories;
  • callout categories;
  • locked feature counts;
  • unsupported feature counts;
  • issue counts;
  • platform, app version, build version, locale, and subscription plan.

Rendering analytics does not include Markdown file contents, file names, personal information, raw LaTeX source, raw Mermaid definitions, raw PlantUML definitions, or generated PDF content. Unknown code language labels and custom callout labels are reduced to allowlisted categories such as other before analytics is sent.

When offline or delivery fails, enabled analytics events may be queued locally in the app for up to 7 days before delivery or deletion.

3.4 Security and Rate Limiting for Rendering Analytics

The stats endpoint is operated on a Sakura Internet VPS and is served behind Cloudflare. For abuse prevention and rate limiting, the endpoint can receive the client IP address made available by Cloudflare. The endpoint uses the IP address only to create an HMAC-derived rate limit key in short-lived server memory.

The stats endpoint does not store raw IP addresses in analytics records. Accepted-event application logs include technical fields such as storage ID, digest prefix, platform, app version, build version, subscription plan, total block count, and whether an event ID was present. They do not include raw IP addresses, user agents, Markdown content, file names, or document source.

3.5 Font Registry

The optional font registry is hosted on Vercel at progressiveworks-co-font-registry.vercel.app. The application uses it only when it checks available installable fonts or downloads a font that you choose to install.

  • The font registry does not receive Markdown content, file names, rendered HTML, or PDF content.
  • Google Fonts is used at registry build time to prepare font assets. Runtime application rendering does not send document content to Google Fonts or any font CDN.
  • The font registry application logs requests for /, /index.json, and /fonts/... with method, path, status, duration, user agent, referer, Vercel request ID, Vercel geo headers, response content length, and cache policy.
  • The font registry application code intentionally does not log IP addresses.
  • We do not use Vercel log drains for the font registry. Vercel may retain standard platform and runtime logs for up to 3 days as part of hosting operations.

3.6 Website Hosting Logs

This website does not use website analytics tools at this time. We do not track website page views or CTA clicks with application-level analytics code.

The website is hosted on Vercel. Vercel may process standard request and runtime log data needed to deliver the website, operate the infrastructure, investigate abuse, and diagnose failures. We do not use Vercel log drains for this website, and standard Vercel logs are retained for up to 3 days.

3.7 Feedback Email

If you contact us by email, we process the information you choose to send. If you choose to include system information from the app, the email may include app version, build version, Markdown rendering engine version and git hash, app language, platform or device information, current subscription state, and diagnostic context. Do not include confidential document content in support emails unless you intentionally want us to review it.

4. How We Use Information

We use information for the following purposes:

  • provide, maintain, and improve the application and website;
  • process Markdown locally for preview and PDF export;
  • verify, restore, and manage premium feature access;
  • provide customer support and respond to feedback;
  • analyze opt-in anonymous rendering statistics to improve Markdown support and rendering quality;
  • prevent abuse, rate-limit requests, investigate failures, and protect service security;
  • comply with legal obligations.

Where GDPR or similar laws apply, we rely on the following legal bases:

  • Performance of a contract: providing the application, premium features, purchase restoration, and support you request.
  • Consent: optional application rendering analytics that you explicitly enable.
  • Legitimate interests: security, abuse prevention, rate limiting, fraud prevention, service reliability, and limited operational logging.
  • Legal obligation: tax, accounting, compliance, and legal response obligations.

You may disable optional application rendering analytics at any time in the app settings.

6. Sharing and Processors

We do not sell your personal information. We do not share Markdown content with analytics, subscription, font registry, hosting, or payment providers.

We use the following processors and infrastructure providers as needed:

  • Apple App Store and Google Play: payment processing, purchase records, subscriptions, refunds, and store-managed user rights.
  • Adapty: subscription entitlement management, paywall configuration, purchase verification, purchase restoration, and fraud prevention.
  • Sakura Internet VPS: hosting for the first-party rendering analytics ingest endpoint.
  • Cloudflare: reverse proxy, security, routing, and rate-limit-related IP forwarding for the stats endpoint.
  • Vercel: website and font registry hosting, standard platform logs, and runtime logs.
  • Email service providers: delivery and storage of emails you send to us.

We may also disclose information when required by law, to protect our rights or safety, or as part of a merger, acquisition, or sale of assets.

7. Data Retention

We retain different information for different periods:

  • Markdown content and generated PDF content: not stored on our servers.
  • Local settings and installed font state: stored on your device until you clear app data or uninstall the app.
  • Application analytics local queue: up to 7 days before delivery or deletion.
  • Delivered raw application rendering analytics: up to 180 days.
  • Stats endpoint short-lived rate limit keys: retained only in server memory for the configured rate-limit window.
  • Font registry application logs: retained only through Vercel standard logging for up to 3 days. We do not use log drains.
  • Website hosting logs: retained only through Vercel standard logging for up to 3 days. We do not use log drains.
  • Subscription and purchase data: retained as long as necessary to verify premium purchases, restore subscriptions, provide support, prevent fraud, and meet app store, tax, accounting, and legal obligations.
  • Feedback email: retained as long as reasonably necessary to respond, provide support, and maintain business records.

8. Cookies and Tracking Technologies

The application does not use browser cookies.

This website does not currently use behavioral analytics cookies or tracking scripts. Future introduction of website analytics would require an implementation and policy update.

9. Your Rights and Choices

Because markup does not require accounts, many choices are controlled through your device, app settings, browser settings, and app store account.

  • You can disable application rendering analytics at any time in app settings.
  • You can reset analytics consent in app settings to show the consent dialog again.
  • You can clear local settings and preferences through app or device settings.
  • You can uninstall the application to remove app-local data from your device.
  • You can use app store purchase restoration tools to restore premium access.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data we process. To exercise these rights, contact us at legal@progressiveworks.co. We may need to verify your request before responding.

10. International Transfers

Your information may be processed in Japan, the United States, or other countries where our providers operate. Where required, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, provider data processing terms, or other lawful transfer mechanisms.

11. Security

We use technical and organizational measures designed to protect information, including encrypted transport, access controls, least-privilege operational practices, rate limiting, and regular dependency and infrastructure maintenance. No system can be guaranteed to be completely secure.

12. Children’s Privacy

The Service is not intended for children under 13 years of age, or the minimum age required by local law. We do not knowingly collect personal information from children below that age. If we become aware that we have collected such information, we will take steps to delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this website and making the same policy available within the application. We may also include notices in app store release notes when appropriate.

14. Contact Information

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: legal@progressiveworks.co
Address: N&E BLD. 6F, 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan
Website: https://progressiveworks.co

15. Jurisdiction-Specific Information

15.1 California Residents

California residents may have additional rights under applicable California privacy laws, including the right to know about personal information collection and the right to delete certain personal information.

15.2 European Union, EEA, UK, and Swiss Residents

Residents of these jurisdictions may have rights under applicable data protection laws, including rights to access, rectify, erase, restrict processing, object to processing, data portability, and lodge a complaint with a supervisory authority.

This Privacy Policy was last updated on June 5, 2026. Please review this policy periodically for any changes.